Algeria's National Authority for the Protection of Personal Data has approved new controls governing the publication and processing of images and recordings of individuals across digital platforms and social media sites. The new regulations aim to implement Law No. 18-07, which focuses on the protection of natural persons in the field of personal data processing. These measures apply to platforms such as Facebook, Instagram, and TikTok, introducing stricter guidelines for content sharing and emphasizing individual rights.
The authority's decision shows a concerted effort to safeguard personal information in the digital age, aligning with global trends in data privacy. These full provisions are formally outlined in Deliberation No. 04, which was issued on July 15, 2026. This deliberation provides the specific framework for how personal data, particularly in visual and audio formats, must be handled by processors and platforms operating within or impacting Algerian citizens.
Consent and Data Transfer Rules
A cornerstone of the new framework is the requirement for explicit consent. Publishing images or recordings of individuals intended for public consumption requires free, explicit, prior, and verifiable consent from the person depicted, unless a specific legal or regulatory basis permits otherwise. This stipulation ensures that individuals maintain control over their personal likeness and voice when shared in public digital spaces.
Under Article 03 of Algeria's Law No. 18-07, audio-visual images and recordings that enable the identification of a natural person are classified as personal data. This classification notes the broad scope of protection afforded to individuals under the new regulations.
The new regulations further stipulate that publishing images on foreign platforms such as Facebook, Instagram, and TikTok constitutes a transfer of personal data outside Algerian national territory. This classification applies if these platforms host, store, process, or allow access to the data from locations outside Algeria. This designation is critical as it subjects such data transfers to specific regulatory oversight, ensuring that even data managed by international entities adheres to Algerian privacy standards. This approach aims to protect Algerian citizens' data regardless of where it is physically stored or processed by these global platforms.
Processor Obligations and Individual Rights
Processors of personal data are now required to inform individuals clearly and in advance about several key aspects of data handling. These aspects include the identity of the processor, the specific purpose of any recording or filming, the intended means of publication or broadcast, and the duration for which data will be retained. Individuals must also be apprised of their legal rights concerning their personal data, ensuring transparency and empowering them to make informed decisions about their information.
Both the primary processor and any sub-processors must implement appropriate organizational and technical measures. These measures are designed to ensure the security, confidentiality, and integrity of all personal data under their management. This obligation shows the full approach to safeguarding individual information within the new regulatory framework, aiming to prevent unauthorized access, disclosure, alteration, or destruction of personal data.
In parallel with these new obligations, the National Authority for the Protection of Personal Data has established a new channel for public engagement. An electronic service is now available on its official website, specifically for individuals to submit complaints and protests regarding personal data issues. This digital mechanism simplifies the process for citizens to report concerns and seek redress.
Regulatory Context and Enforcement
These provisions are formally outlined in Deliberation No. 04, which was issued on July 15, 2026. This deliberation serves as the practical implementation guide for Law No. 18-07. Under the new framework, individuals are granted the right to submit a complaint or protest directly to the National Authority for the Protection of Personal Data. This mechanism allows citizens to report instances where they believe their personal data processing or publication infringes upon the stipulations of Law No. 18-07 or the recently enacted deliberation, thereby strengthening enforcement and accountability.
